The Play ransomware gang has released data allegedly stolen from Dutch maritime logistics services company Royal Dirkzwager.
Founded in 1872, the company provides ship management services to hundreds of organizations in the maritime industry, including monitoring of incoming and outgoing vessel traffic in ports, emergency response services, and more.
Royal Dirkzwager fell victim to the cyberattack on March 6, being forced to take systems offline and suspend several services.
While restoration operations started immediately, the company needed roughly a week before being able to clean and fully restore its systems and resume the first services.
At the beginning of last week, Royal Dirkzwager confirmed that it fell victim to a ransomware attack, without providing specific details on the matter.
On March 16, the company announced that almost all services were fully functional, and that it was addressing the last issues.
On the same day, however, the Play ransomware gang published on its Tor leak site a 5 Gb archive containing data allegedly stolen from the maritime services company.
The archive, the ransomware operators say, includes both private and personal data, contracts, employee IDs, passports, and more, but they claim it represents only a portion of the data that was exfiltrated from Royal Dirkzwager’s systems.
The cybercriminals also threaten to publish the full batch of data if Royal Dirkzwager does not respond to their demands.
Also referred to as PlayCrypt, the Play ransomware was first spotted in June 2022, but has become one of the most active ransomware families recently.
In February 2023, the Play gang made seven victims, but has already claimed 13 attacks since the beginning of March, data from deep web intelligence project DarkFeed shows. In January, the criminal enterprise was the fifth most active ransomware group.
SecurityWeek has emailed Royal Dirkzwager for additional information on the attack, but has received no response.
Related: Play Ransomware Group Claims Attack on A10 Networks
Related: Play Ransomware Group Used New Exploitation Method in Rackspace Attack
Related: US Government Warns Organizations of LockBit 3.0 Ransomware Attacks
More from Ionut Arghire
- Information of 2.5M People Stolen in Ransomware Attack at Massachusetts Health Insurer
- US, South Korea Detail North Korea’s Social Engineering Techniques
- High-Severity Vulnerabilities Patched in Splunk Enterprise
- Enzo Biochem Ransomware Attack Exposes Information of 2.5M Individuals
- Google Temporarily Offering $180,000 for Full Chain Chrome Exploit
- Toyota Discloses New Data Breach Involving Vehicle, Customer Information
- Adobe Inviting Researchers to Private Bug Bounty Program
- Critical Vulnerabilities Found in Faronics Education Software
Latest News
- Insider Q&A: Artificial Intelligence and Cybersecurity In Military Tech
- In Other News: Government Use of Spyware, New Industrial Security Tools, Japan Router Hack
- OpenAI Unveils Million-Dollar Cybersecurity Grant Program
- Galvanick Banks $10 Million for Industrial XDR Technology
- Information of 2.5M People Stolen in Ransomware Attack at Massachusetts Health Insurer
- US, South Korea Detail North Korea’s Social Engineering Techniques
- High-Severity Vulnerabilities Patched in Splunk Enterprise
- Idaho Hospitals Working to Resume Full Operations After Cyberattack
